Privacy Policy

1. Data Controller

The administrator of personal data is Igor Oprządek.

Bągart 14A, Poland
E-mail: privacy[at]weborbiton.com

2. Data Protection Officer

No Data Protection Officer has been appointed.

3. Nature of the Service

MevaSearch is a private internet search engine available in a premium model.

• no search history assigned to the user
• no user profiling
• no cross-site tracking
• no tracking identifiers
• no sale of user data to third parties

4. Scope of Processed Data

Using MevaSearch requires creating an account and purchasing access through an external Payment Processor.

In connection with this, the following data may be processed:

Account Data

• e-mail address
• information about active subscription / access
• Kids Mode status (enabled/disabled), set by the account holder

Payment Data

• transactional data processed by the authorized Payment Processor. We do not store your full credit card details on our servers.

Technical Data

• IP address (exclusively for technical, security, and diagnostic purposes)
• date and time of request
• browser and device type

Search Data

• are not saved in a way that allows user identification
• are not assigned to the account
• do not create a search history
• are forwarded to external search index providers in anonymous form (see Section 8)

Photo Search Data

Photo search works only if you choose a photo yourself and agree to the notice shown the first time you use it. Here is what happens to your photo:

• On your device: before anything is sent, your browser makes the photo smaller and removes the hidden information stored in the file — such as the location where it was taken and the phone model.
• Recognition: the photo is sent to Claude, an AI service by Anthropic (see Section 8), which tells us what is in it. If you add an optional question (for example "where can I buy it?"), it is sent together with the photo and kept just as briefly. You get a short description and the search results for it.
• Nothing is kept by MevaSearch: the photo is not saved on our servers, not written to our logs and not linked to your account. It exists only for the few seconds needed to process it.
• No face recognition: the AI is instructed never to say who a person in the photo is.
• Not for children: photo search is switched off in Kids Mode and on kids' profiles, because a child cannot give this consent on their own.
• Your plan's limit: each photo search counts as one AI query in your plan. We only count how many queries you use, not what they were.
• Illegal content: photos showing the sexual abuse or exploitation of children are refused. We then record only the time, your account number and the reason — never the photo — and after repeated attempts photo search is switched off for your account for 24 hours (see also the Terms of Service, Section 8).

5. Analytics: PriviMetrics

The service uses its own analytical system, PriviMetrics, which is privacy-first and self-hosted.

• no cookies / no user tracking
• privacy-first aggregated data (number of visits, country, browser type)

6. Purposes and Legal Basis (GDPR)

• service provision (account, premium access): Art. 6(1)(b) GDPR
• ensuring the security and operation of the service: Art. 6(1)(f) GDPR
• privacy-focused traffic analysis: Art. 6(1)(f) GDPR
• forwarding anonymous search queries to external index providers to deliver results: Art. 6(1)(b) GDPR
• forwarding anonymous queries to an AI provider to generate content summaries: Art. 6(1)(b) GDPR
• photo search (sending a photo you choose to an AI service to recognise it): your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time by clearing MevaSearch's data in your browser settings — no photo is sent again until you agree once more. Withdrawing consent does not affect searches made before.
• Kids Mode settings management (parental control feature): Art. 6(1)(b) GDPR

7. Server Logs

The server records technical logs containing the IP address exclusively for technical and security purposes.

8. Data Recipients and Sub-processors

MevaSearch uses the following external service providers. Where search queries or AI prompts are transmitted, they are forwarded in anonymous form, without any user identifier, account reference, or personal data attached. The providers listed below receive only the query text and standard technical request metadata (e.g. server-side IP of MevaSearch). The only exception is content your browser loads directly, described below under "Content Loaded Directly by Your Browser".

Infrastructure & Payments

• Hostinger: hosting provider (server infrastructure). Physical service files and user account data are stored on servers located in Lithuania (primary), with backup copies maintained in France. Both locations are within the European Economic Area (EEA). The service additionally uses a global Content Delivery Network (CDN) for static asset delivery (scripts, stylesheets, fonts). CDN edge nodes may be located outside the EEA; no personal user data is stored or processed at CDN nodes.
• Polar.sh (Polar Signals Inc.): payment processor and authorized reseller
• Titan Mail (Titan World Inc.): business e-mail hosting provider, used for sending and receiving account-related and support correspondence.
• Brevo (Sendinblue SAS): transactional and account-related e-mail delivery provider. Used to send service notifications (e.g. account, billing, and security-related messages) to users. Brevo's terms and privacy policy apply to this processing.

Search Index Providers (anonymous queries only)

• Brave Search API (Brave Software, Inc.): web search index. Queries are forwarded without any user identifier; only the query text and MevaSearch's server-side IP are transmitted. Data processing by the provider is governed by the standard API terms and Brave's privacy policy: brave.com/privacy. No personal data of MevaSearch users is shared with Brave.
• Mojeek API (Mojeek Ltd.): independent web search index. Queries are forwarded anonymously, without any user identifier.
• WebAtlas Index API: web search index. Queries are forwarded anonymously, without any user identifier.
• Odysee API (Odysee/LBRY, Inc.): video search index. Queries are forwarded anonymously, without any user identifier.
• PeerTube via Sepia Search (Framasoft): video search across PeerTube servers for the Videos tab. Queries are forwarded anonymously, without any user identifier.
• Unsplash API (Unsplash Inc.): free image search for the Images tab. Queries are forwarded anonymously, without any user identifier. Photos are loaded directly by your browser (see "Content Loaded Directly by Your Browser" below). Unsplash processes data under its own privacy policy: unsplash.com/privacy.
• Wikimedia Commons (Wikimedia Foundation, Inc.): free image search for the Images tab and the optional image strip in web results. Queries are sent from our servers without any user identifier. Commons images are not shown with Strict SafeSearch or in Kids Mode.
• Deezer API (Deezer S.A.): music search for the optional Music tab (tracks, artists and albums). Queries are sent from our servers without any user identifier.
• Podcast Index (Podcast Index LLC): podcast search for the optional Podcasts tab. Queries are sent from our servers without any user identifier. Podcast Index keeps its request logs for up to 90 days. If it is unavailable, the query is sent instead to the Apple iTunes Search API (Apple Inc.), also without any user identifier.
• Specialist sources for additional results: when you ask for more results after the main and Mojeek results, our servers may search Stack Exchange / Stack Overflow (Stack Exchange, Inc.) for programming questions, MDN Web Docs (Mozilla Corporation) for web development documentation, OpenAlex (OurResearch, a non-profit) for scientific papers, Europe PMC (EMBL-EBI) for medical and life-science papers, Open Library (Internet Archive) for books, Zenodo (CERN) for research data and software, Codeberg (Codeberg e.V.) for open-source projects and Vulnerability-Lookup (CIRCL, Luxembourg) for security vulnerabilities (only when a CVE number is searched). These services receive only the query text, without any user identifier.

Other Services Used by Search Features (no personal data)

Some features need extra information about a result or a place. These requests are made by our servers, so the services below see only MevaSearch's server IP and the data listed — never your IP address or account.

• WeatherAPI.com: weather and air quality in search suggestions and results. Receives only the city name you searched for.
• Domain information: when you open the details of a result's domain, our server asks public domain registries (via RDAP, rdap.org or WHOIS) for the registration date and registrar, and the Internet Archive (archive.org) for the date the site was first archived. They receive only the domain name.
• Result checks: if dead-link marking is on (default), our server briefly checks the result pages to see if they still work and whether they publish an official rating. The websites see only a request from MevaSearch's server, not from you.
• Image proxies: YouTube thumbnails (from YouTube / Google LLC), PeerTube video thumbnails (from the independent servers that host the videos), Deezer covers and podcast artwork are downloaded by our server and shown to you from mevasearch.com, so these services do not see your IP address.

Content Loaded Directly by Your Browser

A few items are loaded straight from another service. When this happens, that service sees your IP address and browser details (like when you visit any website), but not your search or your account:

• Brave (Brave Software, Inc.): site icons (favicons) and result thumbnails from icons.search.brave.com and imgs.search.brave.com. You can turn off favicons and thumbnails in Settings.
• Wikimedia Commons: image previews from upload.wikimedia.org in the Images tab and the image strip (the strip can be turned off in Settings).
• Unsplash (Unsplash Inc.): photos in the Images tab are loaded from images.unsplash.com, as required by Unsplash's API terms. Unsplash sees your IP address and browser details and may count views of these photos using an anonymous identifier, but it does not see your search or your account.
• Odysee (Odysee/LBRY, Inc.): video thumbnails from thumbnails.odycdn.com in the Videos tab.
• Deezer: 30-second song previews, only when you press play in the Music tab.
• Podcast hosts: podcast episodes are played directly from the server of the podcast's publisher, only when you press play in the Podcasts tab.

AI Content Generation (anonymous queries only)

• Claude AI (Anthropic PBC): powers all AI features — AI summaries above search results, MevaSearch AI chat, related searches and the AI overview in the knowledge panel. Queries are sent from our servers without your account details or any other identifier, and MevaSearch does not share any personal data of its users with Anthropic for these features. We use Anthropic's paid API, and under its commercial terms Anthropic does not use your queries or the answers to train its models; it keeps them only for a limited time, to detect misuse of its service and where the law requires it. Anthropic's terms apply: anthropic.com/legal/commercial-terms.
• Claude AI (Anthropic PBC), photo search: if you use photo search and agree to it, the reduced photo (without its hidden details) is sent from our servers to Claude, which recognises what it shows. Your account details are not sent. Under Anthropic's commercial terms the photo and the answer are not used to train its models, and Anthropic keeps them only for a limited time, to detect misuse of its service and where the law requires it. Anthropic processes this data on our behalf, as a data processor under its Data Processing Addendum.

9. Kids Mode and Minors

When Kids Mode is active:

• SafeSearch is locked to Strict filtering
• Access to billing, payment settings, and subscription management is blocked
• The mode can only be disabled by entering the account password

MevaSearch does not collect any additional personal data from or about children. No separate child profile is created. The account remains registered to the adult account holder.

Parental responsibility: The account holder (parent/guardian) is solely responsible for enabling Kids Mode and supervising usage. MevaSearch does not guarantee complete filtering of all potentially inappropriate content and does not assume liability for content accessed through search results.

MevaSearch is a service intended for adults (18+). Minors may use the Service only under parental supervision, with the parent or legal guardian as the registered account holder.

MevaSearch does not knowingly collect personal data from children under the age of 16 without verified parental consent, in accordance with Art. 8 GDPR and applicable Polish law. Note: the age of 16 referred to in Art. 8 GDPR relates specifically to the lawfulness of processing personal data of minors, and is separate from the general requirement that the account holder must be an adult (18+).

10. Cookies and Local Storage

MevaSearch uses cookies and browser localStorage strictly for the technical operation of the Service. No advertising, tracking, or analytics cookies are used.

Cookies

• Session cookie: keeps you logged in to your account (standard/rolling 48-hour session, or 30-day rolling session with "remember me"). Strictly necessary; without it the Service cannot authenticate you.
• meva_appLanguage: stores your selected interface language. Retained for up to 12 months.

Local Storage

The Service uses browser localStorage to remember your interface preferences entirely on your device, for example:

• color theme, accent/background/text colors, and font
• SafeSearch level and search region
• result display preferences (layout, favicons, descriptions, thumbnails, link style)
• feature toggles (e.g. AI summaries, sticky search bar, related searches, Music and Podcasts tabs, image strip, dead-link marking, clean links)
• tab order, default search type and the domains you pinned or hid
• Kids Mode status and its password hash, set by the account holder
• that you agreed to photo search, so the notice is not shown again on this device

After a photo search, the description and a small thumbnail of your photo are kept only in the current browser tab (session storage), so they can be shown above the results. They are not sent anywhere and disappear when you close the tab.

These values are stored locally in your browser, are not transmitted to or readable by MevaSearch servers, and are not shared with any third party.

• All of the above are strictly necessary for the correct display and functioning of the interface.
• No personal data is stored in these mechanisms beyond preferences you configure yourself.
• Clearing your browser storage will reset these preferences to default.

11. Retention Period

• technical logs: up to 30 days
• account data: for the duration of the service provision
• analytical data: up to 12 months
• search queries: not retained in any way linked to a user (anonymous, not stored with any identifier)
• abuse protection counters (how many searches an account or profile made today and the time between them, never the queries themselves): up to 3 days
• technical caches (anonymous results from the services in Section 8, domain information, result checks and proxied images): automatically deleted after 1 to 15 days; they never contain your account, IP address or any other identifier
• AI prompts: not retained on MevaSearch servers (processed in transit)
• photos used for photo search: not kept by MevaSearch at all; Anthropic keeps them only for a limited time to detect misuse and where the law requires it (see Section 8)
• record of refused photo searches (time, account number and reason — never the photo): up to 90 days

12. User Rights

• access to data, rectification, and deletion
• restriction of processing and data portability
• objection to processing and withdrawal of consent
• right to lodge a complaint with a supervisory authority (PUODO, the Polish Personal Data Protection Office)

Contact: privacy[at]weborbiton.com

13. Voluntariness of Data

Providing account data is voluntary, but necessary to use the service.

14. Profiling and Automated Decisions

The service does not use profiling or automated decision-making affecting users (Art. 22 GDPR).

15. Data Transfer Outside the EEA

User account data and service files are physically hosted within the European Economic Area (EEA). Primary servers are in Lithuania, backup in France.

The following involves processing that may occur outside the EEA:

• Hostinger CDN (global content delivery network): static technical assets (scripts, stylesheets, fonts) may be cached and served from CDN edge nodes located outside the EEA, including the United States. No personal data, user account information, or search queries are stored or transmitted through CDN nodes.
• Polar.sh (Polar Signals Inc.): United States. Data transfers are subject to appropriate legal safeguards (Standard Contractual Clauses or equivalent).
• Brave Software, Inc.: United States. Anonymous queries from our servers; site icons and thumbnails are loaded directly by your browser.
• Anthropic PBC (Claude AI): United States. Anonymous queries and, with your consent, photos submitted for photo search, processed under Anthropic's commercial terms, its Data Processing Addendum and applicable data transfer mechanisms (Standard Contractual Clauses).
• Titan World Inc. (Titan Mail): United States. Data transfers are subject to appropriate legal safeguards (Standard Contractual Clauses or equivalent).
• Sendinblue SAS (Brevo): European Union (France). No transfer outside the EEA involved.
• Odysee/LBRY, Inc.: United States. Anonymous queries only.
• Wikimedia Foundation, Inc.: United States. Anonymous queries from our servers; image previews are loaded directly by your browser.
• Podcast Index LLC and Apple Inc. (iTunes Search API): United States. Anonymous queries only.
• Deezer S.A.: European Union (France). Anonymous queries; song previews are loaded directly by your browser when you press play.
• Unsplash Inc.: United States. Anonymous queries from our servers; photos are loaded directly by your browser.
• Framasoft (Sepia Search, PeerTube): European Union (France). Anonymous queries only. Video thumbnails are fetched by our servers from the independent PeerTube servers that host the videos, which may be located anywhere in the world; they receive only a request from MevaSearch's server, never your IP address or account.
• Stack Exchange, Inc., Mozilla Corporation, OurResearch (OpenAlex) and Internet Archive (Open Library): United States. EMBL-EBI (Europe PMC): United Kingdom. Anonymous queries only. CERN (Zenodo): Switzerland; Codeberg e.V.: European Union (Germany); CIRCL: European Union (Luxembourg).
• WeatherAPI.com, Internet Archive, domain registries and Google LLC (YouTube thumbnails): may be located outside the EEA, including the United States. They receive only a city name, a domain name or an image request from our servers — no personal data.

All transfers involving personal data are carried out in accordance with Chapter V of the GDPR using appropriate safeguards.

16. Changes to the Policy

We reserve the right to update this policy. Users will be informed of significant changes via e-mail.